Orbeo
Privacy Policy
In force from 23 October 2026
Orbeo is a messenger without a phone number. This page says plainly what is stored, where, and how to remove it. It describes what the service actually does — not what it might do one day.
Who runs Orbeo
The service is operated by Prikota Kirill Olegovich, a self-employed individual. For any question about your data write to support@orbeo.me: you can ask what is stored about you, have it corrected or have it deleted. Requests are answered at the same address.
What Orbeo never asks for
- Your phone number. Registration needs only an Orbeo ID and an access code.
- Your email address. The address stored for sign-in is derived from your Orbeo ID and does not lead anywhere.
- Your address book. The app never reads or uploads your contacts.
There is no advertising inside Orbeo, and the apps have no third-party analytics or trackers. Nothing about you is sold or handed on for marketing. The one exception is the website, described below: we advertise Orbeo on Yandex, and Yandex needs to know whether its ad brought someone in.
What is stored
- Account. Orbeo ID and a hash of your access code — the code itself is never stored. If you add a passkey (Face ID, Touch ID, Windows Hello), only its public part is stored; the private key stays on your device.
- Profile. Display name, description, avatar colour, avatar image if you upload one, chosen decoration and colours, and the links you add yourself.
- Messages and attachments. Text, photos, videos, files, voice messages, stickers, GIFs, polls and votes, reactions, together with who sent them and when. A message you schedule waits on the server until its time comes.
- Chats moved from Telegram or WhatsApp. The export file is read on your device and is not uploaded. Only the messages it contains are added to the conversation you picked: you are shown as the sender, each message is marked “Imported from…” and keeps its original date and the name of its original author as it appears in the export.
- Location. Only when you send it to a chat yourself with the Place button. The point goes to the other person as an ordinary message and is stored with the conversation. The app never determines your location in the background.
- Conversations. Who takes part, group and channel names and handles, and when each participant last read a conversation. In channels, views of posts are counted; the channel's admins see only the numbers, never who viewed.
- Stories. Kept for 24 hours and then deleted together with the picture or video.
- Your stickers and “My GIFs”. Sticker packs you make and short videos you save to “My GIFs”. A picture you turn into a sticker is processed on our server and only the finished sticker is kept.
- “Delete for me”. A note of which messages you hid for yourself, so they stay hidden on all your devices. For everyone else those messages stay as they were.
- Presence. The time you were last seen, so others can see “recently online”. If you hide it in privacy settings, it is not recorded at all — not merely hidden.
- Notifications. A device token issued by the platform, the platform name, your interface language, the notification sound and whether to hide message text in notifications — these are kept per device.
- Country. Taken once, at first launch, from the region set in your phone — not from your location and not from your IP address. It tells us which country's data-protection law applies to your data. Other people do not see it. If it is wrong, write to support@orbeo.me.
- Calls. Who called whom, when, and how long it lasted, and the public keys of the devices used to encrypt the call. Audio and video are never recorded.
- Translations and voice-to-text. When someone in a conversation taps “Translate” or “Text”, the result is kept next to the message, visible only to the members of that conversation, and deleted together with the message.
- Recovery. A bcrypt hash of your twelve-word recovery phrase. The phrase itself is shown to you once and is never stored.
- Age confirmation. If you turn on 18+ content on the website, the fact that you confirmed your age.
- Blocks, reports and moderation. Who you blocked, complaints you send, and decisions taken on them. A message removed by a moderator is kept in a closed quarantine so the decision can be reviewed or undone.
- Server logs. Our servers record the IP address and time of requests, as any web server does. These logs are kept for 14 days.
What stays on your device only
Your chat wallpaper, including a photo you pick for it, the in-app passcode and Face ID lock, and interface settings never leave the device. The Telegram or WhatsApp export file you move a chat from is read on the device and not sent anywhere.
Where it is stored, and who else touches it
- Our own servers, rented from Netcup in Nuremberg, Germany, and administered only by us. They hold the database (since 8 October 2026 — our own installation of the open-source Supabase), videos and files you send, and run calls, translation of messages, voice-to-text, the sticker workshop and the website. The “Translate” button and voice-to-text are handled there by open models: that text and those recordings do not leave our servers.
- Hetzner Object Storage in Nuremberg, Germany, stores photos, voice messages, avatars, stickers, stories and “My GIFs” in a private storage space. Hetzner keeps the files and does nothing else with them.
- Hetzner Storage Box in Helsinki, Finland, keeps nightly backups. They are encrypted before they leave our servers, and the key is only with us.
- Apple Push Notification service (iPhone) and Firebase Cloud Messaging (Google) (Android) deliver notifications. The title and the start of the message pass through Apple or Google in order to be shown on your screen. If you turn on “Hide text in notifications”, only the sender's name and “New message” are sent.
- OpenRouter (and the AI model it routes to) automatically translates posts in the official Orbeo channel and Orbeo's own content channels, and messages in Orbeo's official public chat, into Russian, English and Kazakh. Only the text of those messages is sent. Private chats, other groups and other people's channels never go there.
- GIPHY provides the GIF search. Your search words reach GIPHY through our server, without your account. The previews in the GIF panel are loaded directly from GIPHY, so GIPHY sees your IP address while the panel is open. A GIF you send is copied to our server, and the other person receives it from us.
- Yandex Metrica counts visits to the orbeo.me home pages and clicks on the download buttons, and at web.orbeo.me it receives one mark — “an account was created” — at the moment you sign up in the browser, and nothing else. Yandex sees your IP address, browser and a cookie identifier, as it does on any site with its counter. Session recording (Webvisor) is switched off: your chats, contacts and Orbeo ID are never sent to it. The iPhone, Android, Mac and Windows apps do not contain Metrica.
- Brevo sends our email replies from support@orbeo.me, so your address and our reply pass through it.
Link previews in chats and maps under a shared location are fetched by our server, so the linked site and OpenStreetMap see our server, not you. No other party receives your data.
About encryption — plainly
Calls are end-to-end encrypted. Voice and video are encrypted on your device with a key only the participants have; our call server passes them through without being able to listen. If the other person has an old version of Orbeo, the call still connects, but the screen says “NOT ENCRYPTED”.
Messages do not have end-to-end encryption. Traffic between your device and the server is encrypted, but messages are stored on the server in a readable form — that is what makes them appear on a new device after you sign in, and what makes translation, voice-to-text and search work. Technically, whoever operates the server could read a message. We do not read conversations: a moderator sees a message only when someone has reported it — that message and nothing around it. For anything that must be secret from us as well, use a messenger built for that.
How long it is kept, and how to delete it
Data is kept while your account exists. Settings → Delete account removes your account, your profile, the profile photos you uploaded, your devices' notification tokens and passkeys. Deletion is immediate and cannot be undone.
What stays, said plainly: messages you already sent to other people remain in their copy of the conversation, together with the photos, videos and voice messages attached to them. They are part of someone else's correspondence, and we do not reach into it. Your name is no longer attached to them.
Deleting a single message works in two ways. “Delete for me” hides it only from you, on all your devices; the others keep it. Deleting it for everyone erases its text, its attached file and its translations and transcript, not merely hides them. In a one-to-one chat either person can delete any message for both; in groups and channels — the author or an admin with that right.
Some things expire by themselves: stories after 24 hours, server logs after 14 days. The call diagnostics journal — technical lines about the connection, with nothing of the conversation itself — is collected only from a few test accounts and deleted after 30 days.
Backups are kept so that data survives a server failure: daily copies for 14 days, weekly for 8 weeks, monthly for up to 12 months. They are used only to restore the service. Data you delete disappears from backups as the old copies expire.
Children
Orbeo is not intended for children under 13. If you learn that a child has created an account, write to the address above and it will be removed.
Changes
If this policy changes, the new text appears on this page with a new date. Changes that materially affect you will also be announced inside the app.